Hi, > I'd like to assign a spamassassin score to received word documents > (doc,docx,xls,xlsx) so they are quarantined on my UTM. I've tried the > following which doesn't work. Can someone show me an example that should > work? > > mimeheader DOC_ATTACHED Content-Type =~ /doc/i > describe DOC_ATTACHED email contains a DOC file attachment > score DOC_ATTACHED 12.5
If you're just going to block them outright, you'd probably be better served doing it in your MTA. Assuming you're using postfix? /^(Content-(Type|Disposition)\:|[[:space:]]+).*(file)?name="?.*\.doc"?;?$/ REJECT I believe something like this would work in spamassassin: mimeheader DOC_ATTACHED Content-Type =~ /="[^"]+\.(?:docx?|rtf)"/i score DOC_ATTACHED 12.5 Regards, Alex
